# GE 1.2 attack.sh "could not resolve address"

**URL:** <https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387>\
**Category:** SOC Analyst\
**Created:** [March 20, 2025, 6:21pm UTC](https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387 "2025-03-20T18:21:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![AmberGerbil4579](https://forums.cybrary.it/user_avatar/forums.cybrary.it/ambergerbil4579/32/11_2.png) [@AmberGerbil4579](https://forums.cybrary.it/u/AmberGerbil4579)\
**Post date:** [March 20, 2025, 6:21pm UTC](https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387/1 "2025-03-20T18:21:44Z")

</div>

Hi there, i runned script “attack.sh” on terminal, but get the following errors:

[ERROR] could not resolve address: soc  
[ERROR] could not connect to ssh:…

So, when refreshing the dashboard with “Last 15 min” is empty, and can’t get anwers 3 & 4 for Tasks.

 ![Sin nombre](https://forums.cybrary.it/uploads/default/original/3X/6/4/6488ebf08d91ed2e8b484997a1d53a5f6a7c7a0e.png)

How can I correct the script to make the force attack with hydra & get the anwers?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\
**Post date:** [March 20, 2025, 6:40pm UTC](https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387/2 "2025-03-20T18:40:54Z")

</div>

Hey there - could you please specify the name of the lab and the part/step?

---

<div class="post-metadata">

**Author:** ![ResidentDove8687](https://forums.cybrary.it/user_avatar/forums.cybrary.it/residentdove8687/32/11_2.png) [@ResidentDove8687](https://forums.cybrary.it/u/ResidentDove8687)\
**Post date:** [March 21, 2025, 11:37am UTC](https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387/3 "2025-03-21T11:37:28Z")

</div>

This is SIEM basics 1.2 and I am having the exact same issue. I even changed “soc” to 127.0.0.1 and the script runs but the attack events never show up.

---

<div class="post-metadata">

**Author:** ![ResidentDove8687](https://forums.cybrary.it/user_avatar/forums.cybrary.it/residentdove8687/32/11_2.png) [@ResidentDove8687](https://forums.cybrary.it/u/ResidentDove8687)\
**Post date:** [March 21, 2025, 12:14pm UTC](https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387/4 "2025-03-21T12:14:48Z")

</div>

I will also add that I see the wazuh agent is disconnected, I have restarted this lab over 10 times and the agent never connects. There is also no hosts file entry for the “soc” host. Going to request a refund if this doesnt get fixed in a timely manner.

---

<div class="post-metadata">

**Author:** ![CalmQuail2332](https://forums.cybrary.it/user_avatar/forums.cybrary.it/calmquail2332/32/33622_2.png) [@CalmQuail2332](https://forums.cybrary.it/u/CalmQuail2332)\
**Post date:** [March 21, 2025, 1:16pm UTC](https://forums.cybrary.it/t/ge-1-2-attack-sh-could-not-resolve-address/442387/5 "2025-03-21T13:16:38Z")

</div>

Thanks, I was able to reproduce this issue and fix it. Apologies for the inconvenience.